Trojans using Windows service to update malware

Trojans, worms and viruses are beginning to use the Background Intelligent Transfer Service (BITS) used to update Windows, to dodge firewalls and infect computers, according to new research.

The latest quarterly report from Panda Software's PandaLabs research team said that malware was using the service, often used to deply updates and fix security flaws in Windows, to download malicious code and compromise the host machine.

"Some trojans use this service to send stolen data," the report said. "In this aspect, it is worth mentioning that although it is an original and quite effective way to dodge perimeter security solutions, it requires prior infection, which is not an easy task."

The report also said that cybercriminals are becoming increasingly professional and now offering specific services to other criminals and getting hold of better tools to become more effective in deploying malware on victim's computers.

These specialisations have led to criminals creating channels that mirror legitimate businesses. Criminals are now either creators of malware, distributors or exploiters.

"Nowadays, there are authentic malware markets where services and products are bought and sold," said the report's authors. "Several profile-types converge in them: groups that control large botnets, programmers that offer their own trojans, credit card sales or official document falsification, etc."

The report said that in thes markets, specific trojans for stealing information can be bought and denial of service (DoS) attacks against companies can be contracted out to criminal organisations.

A DoS attack can cost as little as £5-10 an hour and the resources to send 10 million spam messages a day can be bought for £300. The sale of stolen information obtained by downloader trojans is sold by the megabyte with 50MB setting back the criminal just £15.

The report said that most of the markets for these types of malware are usually located in Eastern Europe with Russia being the country to offer the most criminal services.

In most respects the criminals used the same marketing techniques as legitimate businesses and offer "customers" discounts and use other marketing techniques like trying the service before it is purchased.

Email to a friend

Print this page